CVE-2026-83617 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

CVE-2026-83611

xmldom (and @xmldom/xmldom ) is a pure JavaScript XML DOM parser. The vulnerability lies in DOMParser.parseFromString() , which can silently accept a malformed end tag where the tag name is followed by a line break and trailing content (e.g., ), closing the element and discarding the trailing con...

CVE-2026-83609

xmldom (a pure JavaScript W3C XML DOM module) is vulnerable in versions 0.9.0 through 0.9.12 due to a flaw in lib/grammar.js. The shared reg() builder compiles the anchored QName_exact validator with the multiline flag , causing ^ and $ to validate only one line rather than the full name. As a re...

CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-15603

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote client can inject specific Unicode line separator characters into log token values. This manipulation can cause downstream log processing systems to misinterpret a single log entry as multiple...

Exploit-dev-sandbox

MSAK Web Vulnerability Scanner A from-scratch, command-line w...

CVE-2026-33604

A flaw was found in Dovecot. A remote attacker can exploit this by crafting a message with a specific line ending. If Dovecot relays this message, it can bypass security protections, allowing the attacker to inject spoofed email into a vulnerable downstream mail server. This vulnerability is...

PT-2026-84472

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description A denial-of-service issue exists in the command line interface. An authenticated user could exploit this to disrupt the normal operation of the system. Recommendations At the moment, there is ...

PT-2026-84471

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An authenticated low-privileged user can execute arbitrary commands as a privileged user on the underlying operating system through affected command-line...

CVE-2026-73782: Use of Externally-Controlled Format String

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system...

CVE-2026-73776: Improper Verification of Cryptographic Signature

A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authenticated malicious actor with administrative privileges to execute arbitrary code on the underlying operating system, when certain pre-conditions outside of th...

CVE-2026-73768: Improper Input Validation

A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploitation could result in the execution of arbitrary commands with root privileges...

CVE-2026-73767: Improper Neutralization of Special Elements used in an OS Command

Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-73754: Uncontrolled Resource Consumption

Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the normal operation of a vulnerable system...

PT-2026-84485

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description Authenticated command injection flaws exist in the command line interface. Successful exploitation allows a privileged user to execute arbitrary commands on the underlying operating system...

PT-2026-84499

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system...

PT-2026-84493

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description A signature verification bypass exists in the command line interface. This issue allows an authenticated actor with administrative privileges to execute arbitrary code on the underlying...

glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

A flaw was found in GLib. A buffer over-read can occur in giochannelreadlinebackend in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes ...